topic Re: When do you put a | (pipe) as the first character in a search in Splunk Search

When do you put a | (pipe) as the first character in a search

coleman07 — Wed, 20 Jun 2012 13:04:01 GMT

I have noticed several search commands which are preceded by a pipe character with no input left of the pipe. For example:
|eventcount index=*

I looked at what would happen without the pipe and the results were all lines in the searched indexes with the word eventcount. How do you determine whether you must precede a search function with a pipe? Would you also explain what splunk is doing when it sees a pipe without input?

Thank you.

Re: When do you put a | (pipe) as the first character in a search

lguinn2 — Wed, 20 Jun 2012 20:05:14 GMT

Splunk expects the first tokens to be search terms or operators. BUT if the first token is the pipe |, Splunk knows that what follows is NOT a search command, and that it should not search the index(es) for the data.

Beginning a "search" with a pipe is only valid for a few commands (the ones that don't need to retrieve indexed data). Here are a few, I am sure there are others

inputlookup
eventcount
metadata

Re: When do you put a | (pipe) as the first character in a search

erhoward — Sun, 04 Mar 2018 23:05:26 GMT

"inputcsv" is another command where you could begin the command with a pipe.,"inputcsv" is another command where you would begin the command with a pipe.

Re: When do you put a | (pipe) as the first character in a search

verbal_666 — Thu, 17 Jan 2019 22:24:48 GMT

Also "stats" can be a | command. Ex. "| stats count" will result in 0.

Very useful if you want a base matrix to run a next one search starting from a base "fake search" with needed existing fields.

Try

" | stats count | eval l="a,b,c" | makemv delim="," l | mvexpand l "

Re: When do you put a | (pipe) as the first character in a search

niketn — Fri, 18 Jan 2019 02:04:20 GMT

The command this question is looking for is called Generating Command.

While |stats count mimics a generating (report) command scenario as in presence of no events it gives count as 0 instead of no results found, it is actually a ** transforming command ** which is used to generate report (aggregate data).

makeresults or gentimes generating commands can be used instead! Several examples exist for this on Splunk Answers and in Splunk Documentation.

| makeresults 
| fields - _time
| eval data="a,b,c" 
| makemv delim="," data
| mvexpand data

Re: When do you put a | (pipe) as the first character in a search

verbal_666 — Sat, 19 Jan 2019 11:02:32 GMT

Ok, this is "etically" perfect right, but i really need a field count = 0 for ALL next fields, this is the base from where i was starting to generate a next report from a previous Generating Report.

OK, the "concept" is different (Generating Commands or Trasforming Commands), but what i did with "stats" gave me what i need without reported errors.

In my opinion, "|stats" is working fine and i keep on using it.

Thanks, anyway.